Out-of-bounds write when handling split HTTP headers
Summary
| CVE | CVE-2022-28734 |
|---|---|
| State | PUBLISHED |
| Assigner | canonical |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-07-20 01:15:10 UTC |
| Updated | 2026-11-10 12:10:00 UTC |
| Description | Out-of-bounds write when handling split HTTP headers; When handling split HTTP headers, GRUB2 HTTP code accidentally moves its internal data buffer point by one position. This can lead to a out-of-bound write further when parsing the HTTP request, writing a NULL byte past the buffer. It's conceivable that an attacker controlled set of packets can lead to corruption of the GRUB2's internal memory metadata. |
Risk And Classification
Primary CVSS: v3.1 7 HIGH from [email protected]
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Problem Types: CWE-787
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 7 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H |
| 3.1 | [email protected] | Secondary | 8.1 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 8.1 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
HighPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
LowIntegrity
LowAvailability
HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Gnu | Grub2 | All | All | All | All |
| Application | Netapp | Active Iq Unified Manager | - | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | GNU Project | GNU GRUB | affected 2.06-3 semver | Linux |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| CVE - CVE-2022-28734 | af854a3a-2127-422b-91ae-364da2661108 | cve.mitre.org | Third Party Advisory |
| July 2023 Grub Vulnerabilities in NetApp Products | NetApp Product Security | af854a3a-2127-422b-91ae-364da2661108 | security.netapp.com | Third Party Advisory |
| oss-security - [SECURITY PATCH 00/30] Multiple GRUB2 vulnerabilities - 2022/06/07 round | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | Mailing List, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Daniel Axtens (en)
Legacy QID Mappings
- 159883 Oracle Enterprise Linux Security Update for grub2 (ELSA-2022-9471)
- 159884 Oracle Enterprise Linux Security Update for grub2 (ELSA-2022-9469)
- 159943 Oracle Enterprise Linux Security Update for grub2 (ELSA-2022-5099)
- 159967 Oracle Enterprise Linux Security Update for grub2, mokutil, shim, and shim-unsigned-x64 (ELSA-2022-5095)
- 159985 Oracle Enterprise Linux Security Update for grub2 (ELSA-2022-9596)
- 159986 Oracle Enterprise Linux Security Update for grub2 (ELSA-2022-9595)
- 161027 Oracle Enterprise Linux Security Update for grub2 (ELSA-2023-12952)
- 181035 Debian Security Update for grub2 (CVE-2022-28734)
- 240473 Red Hat Update for grub2, mokutil, shim, and shim-unsigned-x64 (RHSA-2022:5100)
- 240474 Red Hat Update for grub2, mokutil, shim, and shim-unsigned-x64 (RHSA-2022:5099)
- 240476 Red Hat Update for grub2, mokutil, shim, and shim-unsigned-x64 (RHSA-2022:5096)
- 240477 Red Hat Update for grub2, mokutil, shim, and shim-unsigned-x64 (RHSA-2022:5095)
- 282811 Fedora Security Update for grub2 (FEDORA-2022-27932fdd06)
- 282866 Fedora Security Update for grub2 (FEDORA-2022-9b4f9af4ce)
- 354332 Amazon Linux Security Advisory for grub2 : ALAS2022-2022-109
- 354535 Amazon Linux Security Advisory for grub2 : ALAS-2022-109
- 355137 Amazon Linux Security Advisory for grub2 : ALAS2023-2023-020
- 355617 Amazon Linux Security Advisory for grub2 : ALAS2-2023-2146
- 377130 Alibaba Cloud Linux Security Update for grub2, mokutil, shim, and shim-unsigned-x64 (ALINUX3-SA-2022:0134)
- 377622 Alibaba Cloud Linux Security Update for grub2, mokutil, shim, and shim-unsigned-x64 (ALINUX3-SA-2022:0164)
- 672021 EulerOS Security Update for grub2 (EulerOS-SA-2022-2242)
- 672026 EulerOS Security Update for grub2 (EulerOS-SA-2022-2221)
- 672031 EulerOS Security Update for grub2 (EulerOS-SA-2022-2255)
- 672032 EulerOS Security Update for grub2 (EulerOS-SA-2022-2268)
- 672109 EulerOS Security Update for grub2 (EulerOS-SA-2022-2318)
- 672131 EulerOS Security Update for grub2 (EulerOS-SA-2022-2289)
- 672248 EulerOS Security Update for grub2 (EulerOS-SA-2022-2611)
- 710619 Gentoo Linux GRUB Multiple Vulnerabilities (GLSA 202209-12)
- 752214 SUSE Enterprise Linux Security Update for grub2 (SUSE-SU-2022:2037-1)
- 752215 SUSE Enterprise Linux Security Update for grub2 (SUSE-SU-2022:2041-1)
- 752216 SUSE Enterprise Linux Security Update for grub2 (SUSE-SU-2022:2036-1)
- 752217 SUSE Enterprise Linux Security Update for grub2 (SUSE-SU-2022:2035-1)
- 752218 SUSE Enterprise Linux Security Update for grub2 (SUSE-SU-2022:2038-1)
- 752221 SUSE Enterprise Linux Security Update for grub2 (SUSE-SU-2022:2064-1)
- 752229 SUSE Enterprise Linux Security Update for grub2 (SUSE-SU-2022:2074-1)
- 907524 Common Base Linux Mariner (CBL-Mariner) Security Update for grub2 (27552-1)
- 940639 AlmaLinux Security Update for grub2, (ALSA-2022:5095)
- 940640 AlmaLinux Security Update for grub2, (ALSA-2022:5099)
- 960155 Rocky Linux Security Update for grub2, (RLSA-2022:5095)
- 960538 Rocky Linux Security Update for grub2, (RLSA-2022:5099)